Gitea + CI: git.carr.pub, NFS storage class, 3 runners

manifests/git/act-runner.yaml

@@ -0,0 +1,75 @@
+# act_runner x3 with docker-in-docker sidecars, so Gitea Actions jobs
+# run as containers on the worker nodes (ARM64).
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: act-runner
+  namespace: git
+spec:
+  replicas: 3
+  selector:
+    matchLabels: {app: act-runner}
+  template:
+    metadata:
+      labels: {app: act-runner}
+    spec:
+      containers:
+        - name: runner
+          image: gitea/act_runner:latest
+          env:
+            - {name: GITEA_INSTANCE_URL, value: "http://gitea.git.svc:3000"}
+            - {name: GITEA_RUNNER_REGISTRATION_TOKEN, value: "eEsa5oEXUCQyTM6Gj9iAqDzofDj0TmoTYftyPOLd"}
+            - {name: DOCKER_HOST, value: "tcp://127.0.0.1:2375"}
+            - {name: CONFIG_FILE, value: /config/config.yaml}
+          resources:
+            requests: {cpu: 50m, memory: 64Mi}
+            limits: {memory: 256Mi}
+          volumeMounts:
+            - {name: work, mountPath: /data}
+            - {name: config, mountPath: /config}
+        - name: dind
+          image: docker:27-dind
+          securityContext:
+            privileged: true
+          env:
+            - {name: DOCKER_TLS_CERTDIR, value: ""}
+          resources:
+            requests: {cpu: 100m, memory: 256Mi}
+            limits: {memory: 1Gi}
+          volumeMounts:
+            - {name: work, mountPath: /data}
+      volumes:
+        - name: work
+          emptyDir: {}
+        - name: config
+          configMap: {name: act-runner-config}
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels: {app: act-runner}
+                topologyKey: kubernetes.io/hostname
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: act-runner-config
+  namespace: git
+data:
+  config.yaml: |
+    runner:
+      capacity: 4
+      timeout: 30m
+      insecure: false
+      fetch_timeout: 5s
+      labels:
+        - "arm64:host"
+        - "ubuntu-latest:docker://node:22-bookworm"
+    cache:
+      enabled: false
+    container:
+      privileged: false
+      options: ""
+      valid_volumes: []